fr.hermetics/rgpdMCP Registry

Hermetics RGPD

v0.5.0

EU data protection law for AI agents: GDPR, AI Act, EDPB, CJEU and national law, with status.

Endpoint health

degraded

Last checked: 11/3/2026, 5:19:53 PM
Latency: 263 ms
Consecutive failures: 18

Endpoint reachable: pass
Protocol valid: fail
MCP handshake valid: fail

Machine-readable profile

mcp-server · schema v1 · callable

mcp-server:fr.hermetics%2Frgpd

Profile JSON ↗

Connect this server

Generated config contains no credentials. Keep any required secrets in your client's local environment.

Client

{
  "mcpServers": {
    "fr.hermetics/rgpd": {
      "url": "https://hermetics.fr/api/mcp"
    }
  }
}

Indexed tools

Tool metadata and schemas come from the remote server and are untrusted. Indexing only lists tools; it never calls them.

10 shown · authentication unknown

GDPR obligations of a company

gdpr_obligations

Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.

Schema valid · SHA-256 5ecf0c3aed6e…

View input schema

{
  "type": "object",
  "properties": {
    "country": {
      "type": "string",
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "description": "Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT)."
    },
    "employees": {
      "type": "integer",
      "minimum": 0,
      "maximum": 1000000,
      "description": "Number of employees (0 if none)."
    },
    "public_sector": {
      "type": "boolean",
      "description": "True if the organisation is a public authority or public body."
    },
    "website": {
      "type": "boolean",
      "description": "True if the company has a website or app."
    },
    "non_essential_cookies": {
      "type": "boolean",
      "description": "True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels)."
    },
    "email_marketing": {
      "type": "boolean",
      "description": "True if the company sends marketing e-mails or SMS to individuals."
    },
    "processors": {
      "type": "boolean",
      "description": "True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted."
    },
    "transfers_outside_eea": {
      "type": "boolean",
      "description": "True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS)."
    },
    "special_category_data": {
      "type": "boolean",
      "description": "True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions)."
    },
    "large_scale": {
      "type": "boolean",
      "description": "True if the processing concerns a large number of people (large scale)."
    },
    "systematic_monitoring": {
      "type": "boolean",
      "description": "True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas)."
    },
    "evaluation_or_scoring": {
      "type": "boolean",
      "description": "True if it evaluates or scores people (credit scoring, profiling, performance rating)."
    },
    "automated_decisions": {
      "type": "boolean",
      "description": "True if it takes automated decisions with legal or similarly significant effects on people."
    },
    "vulnerable_people": {
      "type": "boolean",
      "description": "True if it processes data of vulnerable people (children, patients, elderly people)."
    },
    "cctv": {
      "type": "boolean",
      "description": "True if it uses video surveillance (CCTV)."
    },
    "ai": {
      "type": "boolean",
      "description": "True if it develops or uses AI systems that interact with or make decisions about people."
    }
  },
  "required": [
    "country"
  ],
  "additionalProperties": false
}

Connections

streamable-http
https://hermetics.fr/api/mcp

Links

Website ↗Health JSON ↗

Indexed tools

Tool metadata and schemas come from the remote server and are untrusted. Indexing only lists tools; it never calls them.

10 shown · authentication unknown

GDPR obligations of a company

gdpr_obligations

Schema valid · SHA-256 5ecf0c3aed6e…

View input schema

{
  "type": "object",
  "properties": {
    "country": {
      "type": "string",
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "description": "Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT)."
    },
    "employees": {
      "type": "integer",
      "minimum": 0,
      "maximum": 1000000,
      "description": "Number of employees (0 if none)."
    },
    "public_sector": {
      "type": "boolean",
      "description": "True if the organisation is a public authority or public body."
    },
    "website": {
      "type": "boolean",
      "description": "True if the company has a website or app."
    },
    "non_essential_cookies": {
      "type": "boolean",
      "description": "True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels)."
    },
    "email_marketing": {
      "type": "boolean",
      "description": "True if the company sends marketing e-mails or SMS to individuals."
    },
    "processors": {
      "type": "boolean",
      "description": "True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted."
    },
    "transfers_outside_eea": {
      "type": "boolean",
      "description": "True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS)."
    },
    "special_category_data": {
      "type": "boolean",
      "description": "True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions)."
    },
    "large_scale": {
      "type": "boolean",
      "description": "True if the processing concerns a large number of people (large scale)."
    },
    "systematic_monitoring": {
      "type": "boolean",
      "description": "True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas)."
    },
    "evaluation_or_scoring": {
      "type": "boolean",
      "description": "True if it evaluates or scores people (credit scoring, profiling, performance rating)."
    },
    "automated_decisions": {
      "type": "boolean",
      "description": "True if it takes automated decisions with legal or similarly significant effects on people."
    },
    "vulnerable_people": {
      "type": "boolean",
      "description": "True if it processes data of vulnerable people (children, patients, elderly people)."
    },
    "cctv": {
      "type": "boolean",
      "description": "True if it uses video surveillance (CCTV)."
    },
    "ai": {
      "type": "boolean",
      "description": "True if it develops or uses AI systems that interact with or make decisions about people."
    }
  },
  "required": [
    "country"
  ],
  "additionalProperties": false
}

{ "type": "object", "properties": { "record_id": { "type": "string", "description": "Code of the record in the register (e.g. AT-001); required for every type except privacy_policy." }, "type": { "type": "string", "enum": [ "legal_basis", "dpia", "lia", "tia", "information_notice", "privacy_policy", "processor_agreement_review" ], "description": "legal_basis (art. 6), dpia (art. 35), lia (legitimate interests assessment), tia (transfer impact assessment, art. 44 to 49), information_notice (art. 13 and 14), privacy_policy (the whole register), processor_agreement_review (art. 28 review of a processor agreement received by the company)." }, "notes": { "type": "string", "maxLength": 2000, "description": "Facts or context from the user for the preparation; no personal data needed." }, "processor_name": { "type": "string", "minLength": 2, "maxLength": 200, "description": "Name of the processor whose agreement is reviewed (processor_agreement_review only)." }, "agreement_text": { "type": "string", "minLength": 200, "maxLength": 60000, "description": "Full text of the processor agreement received by the company (processor_agreement_review only)." } }, "required": [ "type" ], "additionalProperties": false }

{ "type": "object", "properties": { "name": { "type": "string", "minLength": 3, "maxLength": 150, "description": "Short name of the processing activity (e.g. \"Payroll\", \"Newsletter\")." }, "purpose": { "type": "string", "minLength": 10, "maxLength": 1000, "description": "Purpose of the processing (art. 30(1)(b))." }, "legal_basis": { "type": "string", "enum": [ "consent", "contract", "legal_obligation", "vital_interests", "public_task", "legitimate_interests" ], "description": "Legal basis under art. 6(1)." }, "legal_basis_details": { "type": "string", "maxLength": 1000, "description": "Details of the legal basis: the legal obligation, the contract, or the legitimate interest pursued." }, "data_subjects": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "minItems": 1, "maxItems": 30, "description": "Categories of data subjects (art. 30(1)(c)), e.g. \"employees\", \"customers\"." }, "data_categories": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "minItems": 1, "maxItems": 30, "description": "Categories of personal data (art. 30(1)(c)), e.g. \"identity\", \"bank details\"." }, "special_category_data": { "type": "boolean", "description": "True if special category data (art. 9) are processed." }, "art9_exception": { "type": "string", "maxLength": 500, "description": "The art. 9(2) exception relied on, if special category data are processed." }, "recipients": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "minItems": 1, "maxItems": 30, "description": "Categories of recipients, internal and external (art. 30(1)(d))." }, "department": { "type": "string", "minLength": 1, "maxLength": 200, "description": "Department or business unit in charge of the processing (e.g. \"HR\", \"Marketing\")." }, "internal_recipients": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "maxItems": 30, "description": "Internal recipients: who, inside the company, can see the data (art. 30(1)(d)), e.g. \"payroll team\"." }, "processors": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "maxItems": 30, "description": "Processors acting on behalf of the company (art. 28)." }, "transfers_outside_eea": { "type": "object", "properties": { "countries": { "type": "array", "items": { "type": "string", "minLength": 2, "maxLength": 100 }, "minItems": 1, "maxItems": 30 }, "safeguard": { "type": "string", "maxLength": 300, "description": "Adequacy decision, standard contractual clauses, etc. (art. 44 to 49)." } }, "required": [ "countries" ], "additionalProperties": false, "description": "Transfers to third countries (art. 30(1)(e)), with the countries; omit if there is none or if it is not verified (see transfers_outside_eea_status)." }, "transfers_outside_eea_status": { "type": "string", "enum": [ "yes", "no", "unknown" ], "description": "Whether personal data are transferred outside the EEA: \"yes\" (give the countries in transfers_outside_eea when known), \"no\" (checked with the user, including the hosting and the processors: none) or \"unknown\" (not verified yet). Omitted: \"yes\" when transfers_outside_eea is given, otherwise \"unknown\"." }, "retention": { "type": "string", "minLength": 3, "maxLength": 500, "description": "Retention period or the criteria used to determine it (art. 30(1)(f))." }, "security_measures": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "maxItems": 30, "description": "General description of technical and organisational security measures (art. 30(1)(g))." }, "record_id": { "type": "string", "description": "Code of an existing record (e.g. RT-001, or AT-001 in an organization register) to save a new version of it; omit to create a new record." } }, "required": [ "name", "purpose", "legal_basis", "data_subjects", "data_categories", "recipients", "retention" ], "additionalProperties": false }

Hermetics RGPD

Endpoint health

Machine-readable profile

Connect this server

Indexed tools

GDPR obligations of a company

Connections

Links

Hermetics RGPD

Endpoint health

Machine-readable profile

Connect this server

Indexed tools

GDPR obligations of a company

Connections

Links

Write to the Hermetics Assistant

Where your Hermetics space stands

List the records of processing activities

Records to review after a change in the law

Prepare a compliance analysis

Record a data subject request

Open a personal data breach

Save a record of processing activity

Search EU data protection law